Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

71–80 of 198 posts

Re: New patches allow building Linux IPv6-only

#71

Post by bigstrat2003 »

everdrive wrote: post #12
rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

NAT demonstrably does not work fine. We have piles of ugly hacks (STUN, etc) that exist only because NAT does. If you really want to keep NAT then nothing stops you from running it on IPv6, but the rest of us shouldn't suffer because of your network design goals.

Re: New patches allow building Linux IPv6-only

#72

Post by toast0 »

apitman wrote: post #49
rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

As sad as it makes me to admit, I don't think IPv6 is ever going to happen without government intervention. Adoption is flat at under 50% over the past year. IPv6 doesn't benefit big tech. SNI routing and NAT work pretty well for centralized platforms. AWS will gladly rent us IPv4 addresses until the end of time.

> IPv6 doesn't benefit big tech.

It does, and big tech has largely adopted IPv6.

For users with IPv6, the v6 path is often less constrained than then v4 path. Serving data faster/more consistently is of benefit to big tech. For a lot of users, v4 and v6 routing are different, which is also helpful for big tech. If you have two paths to the server (and happy eyeballs or something), you have more resiliance to routing issues.

Clouds are slow on v6, but CDNs are not. Adoption on eyeball networks has been very slow, and it's unlikely to speed up much, IMHO. The benefits of v6 for ISPs are not that big for established serviced with large v4 pools. For ISPs running CGNAT, more v6 means less CGNAT and CGNAT is a lot more expensive than plain ip routing. (Doesn't mean all CGNAT providers run v6, but it's an incentive).

Re: New patches allow building Linux IPv6-only

#73

Post by patmorgan23 »

Incipient wrote: post #59

The main thing I don't like is type-ability. Even now I type in 192.168.1.14 to connect to my mates computer to play satisfactory. No way in heck am I trying in an ip6!

Hmmmm maybe someone should come up with a SYSTEM to organize NAMES for ips, maybe using hierarchical DOMAINs.... Oh wait.

Re: New patches allow building Linux IPv6-only

#74

Post by patmorgan23 »

lxgr wrote: post #31
bornfreddy wrote: post #18

IPv6 vs. 4 is like Python 3 vs. 2, just worse.

And IPv6 vs v4 discussions are just like Python 3 vs. 2 discussions: Often much more annoying than just getting it over with and switching.

This. Sure there are still some applications that might be difficult to v6 enable, so either patch it or use one of the myriad of options to give it a v6 front end.

Re: New patches allow building Linux IPv6-only

#75

Post by justsomehnguy »

knorker wrote: post #38
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

So run fc00::/7 addresses with IPv6 NAT. That addresses all of your concerns, and you have that option.

But that doesn't allow to bitch about it so - no.

Re: New patches allow building Linux IPv6-only

#76

Post by craftkiller »

iamnothere wrote: post #47
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default.

Do you ever connect your laptop to any network other than your home network? For example, public wifi hotspots, hotel wifi, tech conferences, etc? If so, you need to be running a firewall _on your laptop_ anyway because your router is no longer there to save you from the other people on that network.

It's also a good idea even inside your home network, because one compromised device on your network could then lead to all your other firewall-less devices being exploited.

Re: New patches allow building Linux IPv6-only

#77

Post by jrm4 »

craftkiller wrote: post #70
jrm4 wrote: post #54

Earlier quoted context omitted.

[flagged]

You can't correlate the number of addresses with the number of devices because IPv6 temporary addresses exist. If you enable temporary addresses, your computer will periodically randomly generate a new address and switch to it. https://www.rfc-editor.org/rfc/rfc8981.html

[flagged]

Re: New patches allow building Linux IPv6-only

#78

Post by craftkiller »

bombcar wrote: post #48
Guvante wrote: post #24

Earlier quoted context omitted.

You already have a public IP address the only difference is if you have a rotating IP address which is orthogonal to IPv6. The only difference is most ISPs rotate IPv4 but not IPv6. Heck IPv6 allows more rotation of IPs since it has larger address spaces.

IPv6 can "leak" MAC addresses of connected devices "behind the firewall" if you don't have the privacy extensions / random addresses in use. There are a number of footguns for privacy with IPv6 that you need to know enough to avoid.

Privacy extensions are enabled by default on OSX, windows, android, and iOS: https://ipv6.net/guide/mastering-ipv6-a-complete-guide-chapt...

On Linux, I think the defaults are left up to the distros so there is a chance of a privacy footgun there. Hopefully most distros follow the example set by Apple and Microsoft (a sentence I never thought I would write...)

Re: New patches allow building Linux IPv6-only

#79

Post by justsomehnguy »

bornfreddy wrote: post #19
doubled112 wrote: post #17

Earlier quoted context omitted.

I recently changed ISPs and have IPv6 for the first time. I mostly felt the same way, but have learned to get over it. Some things took some getting used to. An "ip address show" is messy with so many addresses. Those public IPs are randomized on most devices, so one is created and more static but goes mostly unused. The randomly generated IPs aren't useful inbound for long. I don't think you could brute force scan t…

> Having a public address doesn't worry me. At home I have a firewall at the edge. It is set to block everything incoming. Concern is privacy, not security. Publicly addressable machine is a bit worse for security (IoT anyone?), but it is a lot worse for privacy.

With SLAAC and a random IPv6 you would get at least the same level of privacy. One public IPv4 isn't different from /48 IPv6 network.

Re: New patches allow building Linux IPv6-only

#80

Post by wredcoll »

iamnothere wrote: post #66
ac29 wrote: post #64

Earlier quoted context omitted.

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. This feels like a strawman. If you are making the sort of change that accidentally disables your IPv6 firewall completely, you could accidentally make a change that exposed IPv4 devices as well (accidentally enabling DMZ, or setting up port forwarding…

As someone who has done this while tired, it’s a lot easier to accidentally open extra ports to a publicly routable IP (or overbroad range of IPs) than it is to accidentally enable port forwarding or DMZ.

You could accidentally swap ips to one that had a port forward, some applications can ask routers to forward, etc etc. I donmt know how exactly we'd measure the various potential issues but they seem incredibly minor compared to the sheer amount of breakage created by widespread nat.
Post reply on HN